The current authentication mechanism allows only the user to be logged in from only one device at a time.
If user logs in from browser A and then from browser B the refresh token stored in browser A will no longer be valid. This is because when user logs in to browser B server will issue a new refresh token which will replace the old one. When browser A calls refresh server wont find its refresh token - and refresh will return 404.
So - the user can currently only be logged from one browser on 1 machine at a time - which isn't ideal.
To fix this we need a table RefreshTokens(UserId, RefreshToken) so users can have multiple tokens. Maybe limit to only 3 refresh tokens per user to avoid too much rows? Research...
The current authentication mechanism allows only the user to be logged in from only one device at a time.
If user logs in from browser A and then from browser B the refresh token stored in browser A will no longer be valid. This is because when user logs in to browser B server will issue a new refresh token which will replace the old one. When browser A calls refresh server wont find its refresh token - and refresh will return 404.
So - the user can currently only be logged from one browser on 1 machine at a time - which isn't ideal.
To fix this we need a table
RefreshTokens(UserId, RefreshToken)so users can have multiple tokens. Maybe limit to only 3 refresh tokens per user to avoid too much rows? Research...